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CHAPTER 3 


Introduction 


This chapter aims to discuss if it is possible to prevent unforeseen events. 
The major focus is on analysis and prevention of unforeseen events with 
negative consequences, such as accidents, catastrophes and acts of terror. 
Such events often take place in complex systems, and failures of appro- 
priate organisational interaction and communication among members 
with complementary competence in such systems, may contribute to 
unforeseen events. Risk-analysis methods and tools based on energy- 
barrier models, causal sequence and process models, as well as infor- 
mation-processing models, are presented and their applicability in the 
prevention of unforeseen events is discussed. This also includes the Bow- 
tie approach, as well as other approaches which take into consideration 
organisational factors and social interaction (Norwegian samhandling). 
The conclusion is that unforeseen events can be prevented. However, in 
the aftermath of the implementation of safety and security measures, it is 
not possible to know which events they prevented, or to obtain knowledge 
about their efficiency. An additional strategy for prevention of unforeseen 
events with negative consequences is proposed. 

An unforeseen event may be defined as something that happens sud- 
denly and unexpectedly. Such events are seldom a result of an organ- 
isation’s operational planning, but they can be side-effects of such 
planning. An unforeseen event may have either positive or negative 
consequences. 

Unforeseen events with positive consequences are perceived to con- 
tribute to improvements in quality of life, well-being and happiness. We 
prefer them and like them to happen and consequently, preventing such 
events is not an issue. However, the consequences can also be negative 
and precautionary action is often demanded to mitigate these. Kvern- 
bekk, Torgersen and Moe (2015) restrict the concept of ‘unforeseen events’ 
to events only leading to negative consequences. Accordingly, this chap- 
ter’s focus is on unforeseen events with negative outcomes, such as acci- 
dents, catastrophes and acts of terror. 

To reduce the severity of consequences when an accident, catastrophe 
or act of terror has occurred is, of course, a high-priority community task. 
High priority of emergency preparedness and crew training may improve 
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the handling of foreseen as well as unforeseen events. It aims to reduce 
the level of loss and damage and stabilise the situation after such events. 
It is necessary for society to give priority to loss reduction. However, this 
is not relevant when discussing the prevention of unforeseen events. 

A starting point for further discussion could be to conceptualise events 
with negative consequences as being more or less unforeseen. Events may 
be similar to those which have occurred on previous occasions, but the 
exact point in time for the future occurrence could be difficult to pre- 
dict. It is perceived to be an unexpected event when it happens, because 
nobody had foreseen this occurring. When it appears, the severity of 
the consequences may be the same as the previous occasion, but it may 
also be that the consequences differ somewhat from those anticipated by 
examining previous experience. To separate such events from unforeseen 
events, they may be defined as ‘unexpected events: What characterises 
these events is that it is possible to prevent, as well as stabilise, their con- 
sequences by emergency preparedness, crew training and other counter- 
measures aimed at loss reduction. 

A truly unforeseen event would be one that has never happened before. 
Ordinarily there will not be any past experience about the characteris- 
tics of the specific event or the causal factors that may have contributed 
to its occurrence. Consequently, it would be impossible to give examples 
of such an event before it happens and there is also very little knowl- 
edge about the probability of occurrence and severity of consequences if 
it should occur. Is it possible to identify and prevent events even though 
there is no way of imagining what they could be? 


The suitability of risk analysis methods for 
identifying future unforeseen events 


In the prevention of accidents, catastrophes and acts of terror, the main 
approach has been to examine and learn from the past through accident 
investigation. Examining ‘causal’ factors of past accidents and catastro- 
phes by applying some type of accident analysis method may make it pos- 
sible to put countermeasures in place to thwart these factors, preventing 
the same type of accident from happening in the future. 
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While accident investigation only aims to examine causal factors in 
accidents that have already taken place, risk analysis also concerns the 
analysis of potentially-harmful hazards, irrespective of whether or not 
an accident has already taken place, based solely on the existence of 
potentially-harmful forms of energy or other possible factors which may 
have negative consequences if they get out of control. 

Several data sources in addition to, or in place of, past accidents may 
be necessary to conduct a risk analysis (Rausand & Utne, 2009). This 
includes technical data about the amount of potentially-dangerous chem- 
icals and forms of energy, available devices on machines, etc. Operational 
data, as well as data on risk sources, reliability and maintenance routines 
may also be included. Exposure is taken into consideration when assess- 
ing the ‘level’ of risk as part of such an analysis. Other data sources may 
be meteorological data, data on the possibility of natural catastrophes 
and the possible environmental consequences of an accident or catastro- 
phe. Social conditions and political issues may also be important when 
analysing the risk of acts of terror. 

A problem that emerges when dealing with unforeseen events is that 
opportunities of learning from past experience may be scarce compared to 
the prevention of accidents which occur more or less repeatedly. Could it be 
that risk analysis methods and tools are primarily aimed at examining the 
‘level’ of risk when a potentially-harmful risk source has already been iden- 
tified and that they are less suited to identifying new and unknown risks? 

Risk analysis methods may be divided into: causal sequence and pro- 
cess models (Heinrich, 1959; Weaver, 1980; Gibson, 1961; Primrose, Bent- 
ley, van der Graaf & Sykes, 1996; Rasmussen & Svedung, 2000); human 
reliability and information-processing models (Hale & Glendon, 1987; 
Rasmussen, 1981; Leplat, 1984; Hale & Hale, 1970, Swain & Guttmann, 
1983); and energy-barrier models (Haddon, 1980; Reason, 1994, 19973 
Primrose, Bentley, van der Graaf & Sykes, 1996). A general problem with 
the available risk analysis tools is that they are only perfunctorily asso- 
ciated with a sound theoretical basis. Theoretical perspectives, accident 
models and practical risk analysis tools are often confusingly mixed-up. 
Models are defined as “theories” and risk analysis tools as ‘models’. The 
majority of tools are based on models that do not satisfy the demands 
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for designation as a theory. Due to these problems, the current discus- 
sion will incline towards discussing risk analysis without distinguishing 
clearly between theories, models and tools. 


Process and causal sequence models 


In process and causal sequence models, accidents, as well as other events 
leading to negative consequences, are perceived to be ‘end results’ or neg- 
ative outcomes of a sequence of events. Thus, these models place empha- 
sis on events happening in a chain of events, where causal factors and 
effects are defined by their place in a temporal and time-space continuum 
of events and conditions. 

In the domino approach (Heinrich, 1959), an accident is perceived to 
be the end result of a temporal chain of events consisting of the following 
dominoes: social and environmental factors, personality, risk behaviour, 
an event with negative consequences, and injury or loss (as the end result). 
If one of the dominoes preceding the injury falls, those following it will 
also fall. The domino theory forms the basis for risk analysis tools based 
on modelling the process leading forward to a loss of control and injuries. 

Several core analytical techniques or tools have been based on a pro- 
cess model approach. Event and Causal Factor Charting (ECFC) is a tool 
for charting the sequence of events in a graphical display. Conditions, 
as well as primary and secondary event sequences ‘causing’ an accident 
or catastrophe, are examined. Event and Causal Factor Analysis (ECFA) 
takes this method a bit further, to determine the causal factors by deduc- 
tive reasoning, identifying which events and conditions were necessary 
for an injury to occur. Root Cause Analysis (RCA) is a causal sequence 
model which is also defined as a core analytical technique. So-called TIER 
diagrams are often used as part of the analysis to identify root causes, to 
draw decisive conclusions about why the negative event happened. (DOE, 
1999; see also Sklet, 2002) 

Process and causal sequence models have been criticised because 
organisational factors in accidents have not been taken into consideration. 
The first to address this was Weaver’s (1980) modified domino model. In 
this model, direct causal factors are separated from operational errors. 
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Introducing the latter type of errors recognises the role of management 
and organisational factors in a chain of events. SHE-management models 
and analysis methods have further developed the focus on such factors. 
Another critique of the domino theory was the focus on one, single, tempo- 
ral chain of events, excluding the possibility of examining communication 
processes and social interaction. Benner’s (1975) process theory takes into 
consideration that there could be several participants and parallel, tempo- 
ral chains of events. It focuses on communication and social interaction as 
causal factors in accidents and events with other negative consequences. 

The STEP analysis tool (Hendrick & Benner, 1987) is based on the 
idea that several participants and actions in temporal and time chains 
of events should be the subjects of analysis. Analysis is not restricted to a 
single linear sequence, as is the case in core analytical techniques. It takes 
into consideration that several activities can take place at the same time. 
This also makes it possible to examine the role of social interaction and 
communication in an organisational setting. 

MTO analysis is a tool which constructs an events and causes dia- 
gram, integrating change analysis and barrier analysis in a temporally- 
organised chart of events and causes. A checklist of basic failures includes 
organisational factors, management, technology deficiencies, work man- 
agement, social interaction and communication, as well as issues related 
to instructions and procedures, education and competence, and environ- 
mental factors (Bento, 1999). 

Process models and risk analysis tools based on such models employ 
a temporal conception of events on a timeline, leading forward to a loss 
of control and injuries. An event preceding the next is conceived to be 
part of the ‘explanation’ of the forthcoming event. Using such a concep- 
tion, the timeline understanding of events may easily become mixed 
up with causality, in a way that does not fulfil experimental require- 
ments for inferring causality. However, causal factors can be conceived 
from a theoretical as well as a pragmatic point of view. From the prag- 
matic perspective, a causal factor is conceived to be one which gives 
the power to control the risk source through manipulation (Rasmussen, 
1990). A thorough definition of causality is not the subject of the current 
discussion. 
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Process model-based analytical tools seem to be well-suited to analys- 
ing accidents, catastrophes and other events leading to negative conse- 
quences, to prevent identical or similar events happening in the future. 
The process, as well as the end result, with positive or negative conse- 
quences, has to be known in advance. For analysing unforeseen events 
and the role of communication and social interaction, core analytical 
techniques seem to be inadequate. However, what is interesting about 
several of the process models and analytical tools is that they link acci- 
dents, catastrophes and other events with negative consequences to the 
interaction of technical, organisational and social factors. Some of these 
models and analysis tools, such as STEP analysis, seem to be suitable for 
examining the role of social interaction and communication. 


Human reliability and 
information-processing models 


In this group of approaches, injuries and loss are perceived as the result of 
‘human error’, caused by limitations in human information-processing 
capacity. The theoretical foundation is provided by psychological infor- 
mation processing theories (e.g. Deutsch & Deutsch, 1973; Neisser, 1967, 
Kahneman, 1973). A ‘mismatch’ between system demands and individual 
behaviour is perceived to be the core causal factor in human error. 

Rigby (1970) conceives of human error as behaviour exceeding the 
limits of tolerance within the system in which the person operates, i.e. 
a ‘deviation’ from the norms of the system. Swain and Guttman (1983) 
define human error as an ‘out-of-tolerance action’, in which the limits of 
tolerable performance are defined by the system. In this approach, errors 
are understood to be natural outgrowths of an unfavourable combination 
of people and the situation in which they act. 

In Human Reliability Analysis (HRA), Swain and Guttmann (1983) 
define human error as an act in which a person fails to either carry out 
something correctly, do something as expected, or do something in time. 
Incorrect human outputs are separately categorised as errors of omission 
and errors of commission. Errors of omission occur when someone either 
omits one step in a task or the entire task. Errors of commission comprise 
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selection errors (e.g. reversals and wrong commands), errors of sequence, 
errors of timing (too early or too late), and quantitative errors (too little 
or too much). 

The THERP analysis tool (Swain & Guttmann, 1983) is based on this 
perspective. Estimation of the probability for deviation in task perfor- 
mance consists of defining all the possible fault conditions, mapping tasks 
associated with these conditions, estimating the probability of human 
error, evaluating the consequences of these acts, and proposing counter- 
measures. The definition of human error is a functional evaluation of the 
consequences of behaviour. Human error is conceived in the same way as 
technical failures. Thus, the human ‘component’ may be overloaded and 
fail in the same manner as technical or mechanical components”. 

Human reliability analysis has been criticized for the following rea- 
sons: The approach is normative. It does not take into consideration the 
complexity of human behaviour. The empirical basis which analysis is 
based on is insufficient and the approach fails to take into consideration 
that the same causal factors may cause errors of omission as well as errors 
of commission (Hale & Glendon, 1987). The approach contributes to an 
explanation but not to an understanding of the role of human error in 
accidents and catastrophes. The core focus of analysis is on information- 
processing capacity;communication and social interaction are not taken 
sufficiently into consideration in analysis, neither as causal factors in 
accidents nor causal factors in accident prevention. It is also less suitable 
for explaining acts of terror. 

A more comprehensive model, proposed by Hale and Glendon (1987), 
integrates elements from several other models. It includes LePlat’s (1984) 
model of safe behaviour, which is based on Rasmussen’s (1981) three levels 
of cognitive functioning, as well as Surrey’s (1968) two-level model. Human 
behaviour can either be skill-based, rule-based or knowledge-based. Skill- 
based behaviour is automatically activated in a situation based on obser- 
vation. Rule-based behaviour is based on interpretation. It is controlled 
through rules and instructions. Knowledge-based behaviour is based on 
goals and plans to reach goals. Through training, knowledge-based behav- 
iour may become rule-based and rule-based behaviour may become skill- 
based. Surry (1968) introduces a two-level model distinguishing between 


62 


IS IT POSSIBLE TO PREVENT UNFORESEEN EVENTS? 


the build-up of potentially-hazardous risks and the loss of control. In his 
model, human perception, interpretation, decision-making and action 
are analysed separately in each of the two steps. Hale and Glendon (1987) 
integrate these steps into their model, which distinguishes between input, 
throughput, and output. In this model, the input phase consists of hazard 
identification through the three levels of cognitive-based behaviour (no 
warning signs, warnings, and identification of danger). The throughput 
phase identifies whether or not there is a need for precautionary action. 
If the process of hazard identification has failed, the danger will not be 
controlled and the real risk may continue to be present, or the level of real 
risk may increase. Whether or not the danger is brought under control 
depends on the results of the output phase, i.e. whether or not responsibil- 
ity is taken for the implementation of countermeasures, whether or not the 
necessary procedures for how to carry out safety measures are known to 
those responsible for implementation, and whether or not precautionary 
and mitigation measures have been carried out. In addition to the two 
loops presented, the model also contains several other loops. 

The model places the lack of identification of deviations in the input 
phase. In the control of danger, either warning signs of danger or haz- 
ard identification must be successful to bring the danger under control. A 
lack of problem identification may be the core reason that an event with 
negative consequences is deemed ‘unforeseen’. This model is classified as 
a systems approach to the control of danger. It specifies cognitive informa- 
tion processes, individual-level decisions and behaviour. However, neither 
communication, interaction and social interaction nor contextual factors 
are specified at the same level of detail. Specific contextual factors, e.g. 
situational, organisational and community-related factors that influence 
individual behaviour, are not taken properly into consideration. Hale and 
Glendon’s (1987) model explains very well why accidents can be unexpected 
and even unforeseen, although this was not their primary intention. 


Energy-barrier models 


The Bow-tie method (Primrose, Bentley, van der Graaf & Sykes, 1996) is 
one of the most increasingly-accepted and best methods for analysing 
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risks (Crerand, 2005; see also Ruijter & Guldemund, 2016). It can be clas- 
sified primarily as an energy-barrier model. However, temporal aspects 
are also given attention. It combines several other analytical methods and 
approaches previously known within risk analysis. To understand the 
strengths and limitations of this method, it needs to be discussed in the 
light of preceding energy-barrier models and approaches to which it relates. 

In energy-barrier models (Haddon, 1980), an injury or an event with 
other negative consequences is perceived to take place when energy is 
transferred to the human body. When the energy is above the tolerance 
threshold of the body, this causes an injury. Injuries can be prevented, 
either by placing barriers directly on the energy source, separating the 
energy from the human, or enhancing human resilience, e.g. using per- 
sonal protective equipment. In barrier analysis, the hazards, the target of 
the hazard, as well as the barriers have to be identified. The barriers can 
be physical as well as communication and management-related. 

Analysis methods based on the energy-barrier model are suitable pri- 
marily when hazards can be identified (DOE, 1999; see also Sklet, 2002). 
In barrier analysis, the hazard or potentially-damaging energy as well as 
the possible target have to be identified. Physical and well as management 
barriers are considered; the latter is more difficult to identify than the 
former. After having identified the barriers, probable causes of barrier 
failure and their consequences are investigated. 

Change analysis aims to examine all deviations in a system that cause 
negative outcomes, by comparing an accident-free situation with an acci- 
dent and identifying the differences and their consequences. Accident 
Analysis and Barrier Function analysis are methods of analysis which 
examine ineffective, non-existent and effective barrier functions. In this 
type of analysis, the organisational context as well as the technical sys- 
tems are taken into account when analysing past accidents to propose 
effective countermeasures. The BORA analysis method is another tool for 
analysis of barriers, especially suited to the offshore oil and gas extraction 
industry (see Rausand & Utne, 2009, for a thorough description of this 
analysis method). 

The logical tree model (Johnson, 1980) is also based on the assumption 
that potentially-harmful forms of energy are causal factors in accidents. 
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Such events could be prevented by countermeasures, which consist of barri- 
ers that prevent energy from reaching the human body, for example. MORT 
(Johnsen, 1980) as well as SMORT (Kjellén et al., 1987) are logical tree models, 
based on the identification of specific control factors and management- 
system factors. Causal factors are identified using generic questions. 

These methods are all practical tools for analysing how to prevent inju- 
ries and damage. Energy-barrier models focus primarily on the period 
following a ‘deviation’ in a sequence of events. The period before the devi- 
ation is not perceived to be a relevant subject for analysis. In the case of 
unforeseen events, hazards as well as their targets are usually unknown. 
These risk analysis methods are not well suited to dealing with such 
events. 

Energy and barrier models are often interchanged with process and 
causal sequence models. Change analysis is also partly a process model. 
The same applies to Accident Analysis and Barrier Function analysis. The 
TRIPOD and Bow-tie models can also be classified as energy-barrier and 
process models, as well as causal sequence models. 

The ‘Swiss cheese model’ (Reason, 1990) is the approach which lies 
behind the TRIPOD as well as the Bow-tie model (Alizadeh & Mos- 
hashaei, 2015). Reason (1990) distinguished between active (tokens) and 
latent failures (types). Active failures are errors and violations with an 
immediate negative effect or consequence, usually committed by front- 
line operators, crews and traffic controllers etc. In Reason’s model, these 
types of failures include unsafe acts and inadequate defences in interac- 
tion with local events. Latent failures, on the other hand, are manage- 
ment actions and decisions that have no immediate ‘effect’. They may lay 
‘dormant’ for a period of time, only becoming evident when combined 
with factors such as active failures, technical faults or atypical system 
conditions (Reason, 1990). Latent failures include fallible decisions, line 
management deficiencies and psychological precursors of unsafe acts. 
Unsafe acts are slips, lapses and violations. Psychological precursors 
of unsafe acts include factors such as time pressure and lack of opera- 
tor-safety motivation (Reason, 1994; 1997). 

In a risk-management system based on this approach, the first infor- 
mation loop is the reporting of accidents, injuries and other events with 
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negative consequences. The problem is that this type of information, in 
most cases, is provided too late for proactive measures. The second loop 
consists of identifying and observing unsafe acts at the lower supervisory 
level of an organisation or a system. According to Reason (1990), the most 
effective loop systems are those that identify line management deficien- 
cies (loop 3) and psychological precursors of unsafe acts (loop 4). In the 
prevention of accidents and catastrophes, it is more efficient to focus on 
these loops, i.e. on ‘types’ rather than ‘tokens.’ Thus, in the complete TRI- 
POD model, organisational failures are conceived to be the main causal 
factors because they may contribute to breaches in barriers during oper- 
ational disturbances (Groeneweg, 1998). 

This method identifies basic risk factors for latent failures. An effective 
safety-management system consists of eliminating or reducing the effects 
of the latent failures identified in the model, thereby preventing psycho- 
logical precursors, human behaviour that is ‘out of tolerance’ with the 
system, as well as operational imbalances. 

The Bow-tie method, which has been used extensively in the offshore 
oil and gas extraction industry and several other industries (Pidgeon, 
May, Perry & Poppy, 2007), combines fault tree analysis, causal factor 
charting, and event tree analysis (Lewis & Smith, 2010). It is related to 
the TRIPOD in several ways. However, it is debatable whether or not it 
is a step in the right direction when compared to the emphasis placed on 
organisational and social factors in the TRIPOD, in relation to the capac- 
ity to understand latent failures in complex and unforeseen events. The 
Bow-tie analysis diagram shows the threats, hazards and consequences 
and aims to identify barriers or control measures, as well as recovery 
measures. Pre and post events are analysed. Barriers show mitigation 
activities (Pidgeon et al., 2007). 

Kvernbekk, Torgersen and Moe (2015) present a modified and extended 
Bow-tie model (see also Chapter 1), especially suited to analysing unfore- 
seen events. In addition to being an energy-barrier model, the Bow-tie 
method is also a process model, where the interval between registrations of 
‘warning signs’ prior to an undesirable event is perceived to be important 
for prevention as well as the success of recovery. However, what character- 
ises unforeseen events is that the potentially-dangerous hazards leading up 
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to the event are not identified. How it is possible to identify early warning 
signs of non-identified hazards needs to be thoroughly explained. 

To prevent unforeseen events, according to the Bow-tie model, it is 
necessary to focus on warning signs of potentially-hazardous energy that 
could get out of control, i.e. active failures. This type of indicator is related 
to the chain of events leading to loss of control. Typically, they take place 
on a timeline temporally close to the event with negative consequences, 
which means they are active failures. The chain of events will be specific 
and unique for each case or occurrence. Directing efforts at identifying 
active errors as a prevention strategy will not be effective unless identi- 
cal events happen repeatedly. Therefore, it should also be explained why 
priority should be given to early identification of active failures in the 
identification of unforeseen events. 

Fortunately, major accidents and catastrophes rarely happen and they 
are unique events. The same is true of acts of terror. Unforeseen events 
are also characterised by failures that are unique for each single event. 
It could be argued that when the temporal line of failures is unique, risk 
analysis methods which focus only on active failures and ‘tokens’ will not 
be suitable tools for examining unforeseen events. 

Contrary to ‘tokens,’ ‘types’ are latent failures caused by fallible deci- 
sions at society and managerial level. What is typical for these types of 
failures is that each of them may cause several different temporal chains 
of actions. By focusing on ‘types’ instead of ‘tokens,’ it is possible to pre- 
vent many different action chains which may have negative outcomes. 
Countermeasures aimed at preventing such failures may prevent many 
different action chains and active failures. After the implementation of 
such countermeasures, it will not be exactly clear what types of unfore- 
seen events they have prevented. Therefore, it will also be impossible after- 
wards to learn anything about which events that have been prevented. 

The core aim of the current paper is to answer the question of whether 
or not it is possible to prevent unforeseen events with negative conse- 
quences using risk analysis to identify hazards and warning signals of 
forthcoming injuries and losses. The answer to the question is yes, it is 
possible, but efforts have to focus on latent failures and types. As shown, 
several of the core analytical methods (perhaps even the majority), along 
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with other methods which do not take social interaction into considera- 
tion, have limited interest as analytical tools when aiming to analyse rare 
and unforeseen events. However, analytical tools that include examina- 
tion of social interaction and parallel temporal chains of events also have 
limitations when it comes to understanding the types of events in focus 
in this chapter. The appropriate accident and risk analysis methods may 
contribute to prevention of the unforeseen; however, learning from past 
experience is not possible, because knowledge about what has been pre- 
vented cannot be obtained using these types of analysis. 


Discussion and conclusions 


When investigating accidents, catastrophes and acts of terror, risk anal- 
ysis may focus on latent failures and human error. After identifying the 
causes of failures and errors, prevention measures can be implemented. 
In Figure 3.1, this is entitled the ‘first route’ to safety and security. 
This model is based on a basic understanding of organisational culture, 
branching out from ‘cultural content’, which is the latent, non-observa- 
ble part, and ‘cultural manifestations, which form the observable part of 
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Figure 3.1 A heuristic model for understanding events with negative consequences. 
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culture (Schein, 1990). Reason (1998) also relates the Swiss cheese model 
to safety culture. Part of ‘cultural content’ are norms and values. These 
influence decisions and can cause latent failures, which are ‘cultural 
manifestations’ that can be observed and analysed. All available accident 
analysis and risk analysis methods are based on the ‘first route’. This is 
mainly a temporal route based on accident and risk analysis approaches. 

However, a ‘second route’ could also be proposed (Figure 3.1). Fortu- 
nately, accidents, catastrophes and acts of terror do not happen often. 
Because they cause attention when they occur, they may also be perceived 
to be more frequent than they really are. The ‘second route’ in prevention 
of negative events is, accordingly, to explain why negative events occur so 
rarely. Most of the time, events with negative consequences do not happen, 
which makes it of interest to know why. Unlike the majority of risk analy- 
sis methods and tools, the ‘second route’ is not concerned with analysing 
specific events that have either happened or could happen in the future. 

The interesting question is not why accidents and other negative events 
take place, but rather, why they take place so rarely. What can be done 
to keep it that way? The ‘second route’ is a non-temporal route based on 
a set of indicators connecting accidents, catastrophes and acts of terror 
to indicators of social interaction, i.e. norms and values, risk perception, 
risk tolerance/acceptance, priority of safety and security, and priority 
of precautionary actions. It may be based on knowledge obtained using 
survey methodology aimed at examining associations between organisa- 
tional factors and social interaction. These factors are also connected to 
individual-level behaviour, the status of safety and contingency measures, 
and precautionary actions, as well as risk mitigation measures. Research 
carried out previously has shown these factors to be positively associated 
with accidents in industry as well as in transport. 

The psychometric qualities (reliability and criterion validity) of several 
measurement instruments aimed at measuring all these factors have pre- 
viously been examined and found to be related to accidents and catastro- 
phes (e.g. Iversen & Rundmo, 2012; Nordfjern, Jorgensen & Rundmo, 
2011, 2012; Norfjern, Şimşekoğlu, & Rundmo, 2012; Rundmo 1992; 
Rundmo, 1994a-c; Rundmo, 2000; Rundmo & Iversen, 2004; Rundmo & 
Moen, 2006; Rundmo, Granskaya, & Klempe, 2012). Low scores on these 
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measurement instruments indicate an unsatisfactory safety and security 
level, and high scores indicate a satisfactory level. 

It is interesting to note that measurements of the ‘second route’ can be 
done independently of any specific events or risk sources possibly involv- 
ing potentially-hazardous forms of energy. The main focus of accident 
and risk analysis is on factors causing failures in single accidents and 
analysis of other negative events. The focus of prevention efforts should 
be on the opposite. To prevent negative unforeseen as well as foreseen 
events, the most effective countermeasure is to continue doing what has 
previously been shown to successfully ensure that unforeseen events with 
negative consequences do not happen. To focus on success indicators 
could be especially advantageous when the aim is to prevent unforeseen 
events. 
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